Open Web Application Security Project (OWASP) provides an ongoing list of the Top 10 security flaws that enable a majority of the successful cyberattacks over the past year. The list is a great starting place for setting your cybersecurity training agenda, not only for your security team, but also for your web application developers and DevOps teams.
The best way to avoid these vulnerabilities (and the successful attacks they invite) is to train your teams to fully understand them, know the coding frameworks that eliminate them from being accidentally coded into your applications and have trained security staff who will recognize them if they slip through in third party code or applications updates and changes.
Here is the current OWASP top 10 list.
● Injection
● Broken Authentication
● Sensitive Data Exposure
● XML External Entities (XXE)
● Broken Access Control
● Security Misconfiguration
● Cross-Site Scripting (XSS)
● Insecure Deserialization
● Using Components with Known Vulnerabilities
● Insufficient Logging and Monitoring
To help create that training plan, we have mapped our RangeForce Training Modules to the OWASP’s Top Ten List. As you would expect, of the three RangeForce training tracks, Web Application Security (WASE), Security Operations (SOC), and DevOps, the majority of training falls under web application security, with a few falling under security operations. Here is how the mapping layout.
Injection
- Wase – Blind Command Injection: Find & Exploit (NodeJS)
- Wase – Blind Command Injection: Fix (NodeJS)
- Wase – Blind NoSQL Injection: Find & Exploit (Meteor)
- Wase – Blind SQL Injection: Find & Exploit (PHP)
- Wase – Command Injection: Find & Exploit (PHP)
- Wase – Command Injection: Fix (PHP)
- Wase – NoSQL Injection 1: Exploit
- Wase – NoSQL Injection 1: Find
- Wase – NoSQL Injection 1: Fix
- Wase – NoSQL Injection 2: Exploit
- Wase – NoSQL Injection 2: Fix
- Wase – SQL Injection: Authentication Bypass
- Wase – SQL Injection: Prelude
- Wase – SQL Injection: Union Select
Broken Authentication
- Wase – Cookie Security: HttpOnly: Find & Exploit (NodeJS)
- Wase – Cookie Security: HttpOnly: Find & Exploit (PHP)
- Wase – Cookie Security: HttpOnly: Fix (NodeJS)
- Wase – Cookie Security: HttpOnly: Fix (PHP)
- Wase – Cookie Security: Secure: Find & Exploit (NodeJS)
- Wase – Cookie Security: Secure: Find & Exploit (PHP)
- Wase – Cookie Security: Secure: Fix (NodeJS)
- Wase – Cookie Security: Secure: Fix (PHP)
Sensitive Data Exposure
- Wase – Unrestricted File Upload: Find & Exploit (NodeJS)
- Wase – Unrestricted File Upload: Fix (NodeJS)
- Wase – Cookie Security: Secure: Find & Exploit (NodeJS)
- Wase – Cookie Security: Secure: Find & Exploit (PHP)
- Wase – Cookie Security: Secure: Fix (NodeJS)
- Wase – Cookie Security: Secure: Fix (PHP)
XML External Entities
- Wase – XML External Entity (Java)
Broken Access Control
- Wase – Insecure Direct Object Reference 2: Exploit
- Wase – Insecure Direct Object Reference 2: Fix
- Wase – Insecure Direct Object Reference: Find & Exploit (NodeJS)
- Wase – Insecure Direct Object Reference: Find & Exploit (PHP)
- Wase – Insecure Direct Object Reference: Fix (NodeJS)
- Wase – Insecure Direct Object Reference: Fix (PHP)
- Wase – Path Traversal: Find & Exploit (NodeJS)
- Wase – Path Traversal: Find & Exploit (PHP)
- Wase – Path Traversal: Fix (NodeJS)
- Wase – Path Traversal: Fix (PHP)
- Wase – JSON Web Token Security
- Wase Challenge – JWT 1
- Wase Challenge – JWT 2
- Wase Challenge – JWT 3
- Wase – API Security: Exposed Tokens
- Wase – Cookie Security: HttpOnly: Find & Exploit (NodeJS)
- Wase – Cookie Security: HttpOnly: Find & Exploit (PHP)
- Wase – Cookie Security: HttpOnly: Fix (NodeJS)
- Wase – Cookie Security: HttpOnly: Fix (PHP)
- Wase – Cookie Security: Secure: Find & Exploit (NodeJS)
- Wase – Cookie Security: Secure: Find & Exploit (PHP)
- Wase – Cookie Security: Secure: Fix (NodeJS)
- Wase – Cookie Security: Secure: Fix (PHP)
Security Misconfiguration
Currently no direct coverage
Cross-site Scripting
- WASE – DOM-based XSS: Fix (JavaScript)
- WASE – XSS Filter Evasion: Find & Exploit (PHP)
- WASE – XSS Filter Evasion: Fix (PHP)
- WASE – XSS: Reflected
- WASE – XSS: Stored
- WASE – XSS: Stored-based Phishing
Insecure Deserialization
- WASE Learning – Insecure Deserialization (Java)
Using Components with Known Vulnerabilities
- SOC – Docker RunC Container Escape
- SOC – Privilege Escalation: Kernel Exploit (Dirty Cow)
- SOC Challenge – Uncontained
- SOC Challenge – Webmin
Insufficient Logging and Monitoring
- Wase – XSS Filter Evasion: Find & Exploit (PHP)
- Wase – XSS Filter Evasion: Fix (PHP)
- Security Tools – Brute-force Defense
- SOC – IDS/IPS: Suricata Basics
- SOC – IDS/IPS: Suricata IDS Rules
- SOC – IDS/IPS: Suricata Rule Management
As you design your 2020 training plan, align the training of your web application team to match these modules. For your security team, the SOC tracks are critical but don’t forget to include the WASE tracks focused on cross-scripting attacks, cookie security and SQL injection. These topics will help your analyst and forensic teams quickly identify attacks that fall into these categories.
As RangeForce constantly adds new modules, we will update this mapping every few months. If you need support in developing your training plan or want to test drive a few of these modules just reach out and ask.
Read more about the RangeForce Training Modules.
About OWASP
OWASP is a worldwide nonprofit organization that focuses on improving software security. The main mission of OWASP is to ensure that software security is visible and to provide insights and tools to help improve application security globally.